Wireshark · Ethereal-dev: [Ethereal-dev] Another Stupid Question

[David Frascone <dave@xxxxxxxxxxxx>]

Do tvbuffers help solve the problem of tcp fragmenting the input stream?

Basically, I've got an input stream of packets.  How should I handle packet
fragments, and oversized packets, when TCP arbritrarily combines and splits
them?

For example, let's assume the client is sending 200 byte blocks to the server,
and that the client sends 10 packets.

TCP would send (Assuming a MTU of 1500):

1500 bytes, containing 7 and a HALF packets in the first block
500 bytes, the 2 and a HALF remaining packets.

Has this been handled by ethereal, or do I have to put a static buffer into
my dissector.

Are there any other dissectors that handle this that I can steal from?


Thanks in advance,


DAve